102 The Human Contribution Some holes due to active failures Hazards Other holes due to latent conditions Losses Successive layers of defences, barriers, and safeguards Figure 5.5 The latest version of the Swiss cheese model effects. I will discuss this distinction further and elaborate upon the current model in later chapters. Person and System Models: Getting the Balance Right We have already discussed the weaknesses of the person model at some length, all of which relate to the “‘human-as-hazard’ perspective. The ‘human-as-hero’ view is quite another matter and will be considered extensively in the next part of this book. Although the system models seem, on the face of it, to be far more appropriate ways of considering accident causation, both in terms of understanding the contributing factors and in their remedial implications, they too have their limitations when taken to extremes. This was first brought home to me by the brilliant essays of Dr Atul Gawande, a general surgeon at a large Boston hospital and a staff writer on science and medicine for the New Yorker. Inanessay entitled’ When doctors make mistakes’ ,5'DrGawande recounts the many successes of American anaesthesiologists in 50 Atul Gawande’s articles for the New Yorker are collected in two wonderful books: Complications: A Surgeon's Notes on an Imperfect Science (New York: Metropolitan Books, 2002) and Better: A Surgeon's Notes on Performance (New York: Profile Books, 2007). 51 Gawande (2002), pp. 47-7498 The Human Contribution Atypical conditions Latent failures at the ‘managerial levels Psychological Precursors Unsafe acts Trajectory of accident opportunity Defence-in-depth Figure 5.2 Part of the earliest version of the Swiss cheese model. The diagram shows a trajectory of accident opportunity penetrating several defensive layers, and begins to have Emmenthale-ish features I think it has to be Figure 5.2, although it only includes the last few slices. It was there that I adopted the pictorial convention of showing the precursors and unsafe acts as holes through which an accident trajectory could pass. Early 1990s version A later variant (see Figure 5.3) assumed that a variety of organisational factors could seed latent pathogens into the system. These included management decisions, core organisational processes - designing, building, maintaining, scheduling, budgeting, and the like - along with the corporate safety culture. The significant thing about culture is that it can affect all parts of the system for good or ill. There were two ways in which the consequences of these upstream factors could impact adversely upon the defences. There was an active failure pathway in which error- and violation-producing conditionsThe Human Contribution | Unsafe Acts, Accidents and Heroic Recoveries | JAMES REASON Professor Emeritus, The University of Manchester, UK ASHGATE mmaa | Hazards, Defences and Losses 9 The ‘Swiss Cheese’ Model of Defences In an ideal world all the defensive layers would be intact, allowing no penetration by possible accident trajectories—as shown on the left-hand side of Figure 1.4. In the real world, however, each layer has weaknesses and gaps of the kind revealed on the right-hand side of the figure. The precise nature of these ‘holes’ will be discussed in the next section; here, it is necessary to convey something of the dynamic nature of these various defences-in-depth. Defences in depth Figure 1.4 The ideal and the reality for defences-in-depth Although Figure 1.4 shows the defensive layers and their associ- ated ‘holes’ as being fixed and static, in reality they are in constant flux. The ‘Swiss cheese’ metaphor is best represented by a moving picture, with each defensive layer coming in and out of the frame according to local conditions. Particular defences can be removed deliberately during calibration, maintenance and testing, or as the result of errors and violations. Similarly, the holes within each layer could be seen as shifting around, coming and going, shrinking and expanding in response to operator actions and local demands. How are the ‘holes’ created? To answer this, we need to consider the distinction between active failures and latent conditions.®MANAGING THE RISKS OF ORGANIZATIONAL ACCIDENTS JAMES REASON Ashgate Aldershot * Burlington USA * Singapore « Sydney